Back to rankings

Claude Code Closes Sandbox, Monitor Hook and Settings-Source Gaps in 2.1.314

Claude CodeView original changelog

Claude Code 2.1.314 fixes a group of cases where the agent could act outside what a user authorized. Sandbox protections now apply to a worktree entered through claude -p --resume or --continue, hooks matching Bash now run on commands started by the Monitor tool, and a settings file excluded with --setting-sources no longer supplies auto mode rules or saved consents. File tools also now ask before editing the local copy of organization-managed settings.

Key Takeaways

  • Sandbox protections now apply to worktrees entered by claude -p --resume or --continue, which they previously skipped.
  • Hooks matching Bash now run on Monitor tool commands, though they can only block or ask, not approve or rewrite.
  • A settings file excluded with --setting-sources no longer leaks auto mode rules or saved consents.
  • File tools now ask before editing the local copy of managed settings, as they do for user settings.
  • /permissions Recently blocked refuses to approve a call that cannot be read in full.
  • The Bash shell now clears inherited which aliases and functions, so which is always the system command or zsh builtin.

A cluster of boundary fixes

Claude Code 2.1.314 includes several changes that all concern the same question: can the agent do something the user did not authorize? Each one closes a path where a protection existed on paper but did not apply.

Sandbox and worktrees

Sandbox protections were not applied to a worktree entered by claude -p --resume or --continue. In that situation a resumed headless session could end up working in an isolated worktree without the sandbox that the same session would normally have. The release fixes this so the protections apply.

Hooks on Monitor commands

Hooks that match Bash were not running on shell commands started by the Monitor tool. The release makes them run. Anthropic notes a limit: such hooks can block or ask, but they cannot approve or rewrite those commands. A related change makes hook if conditions such as Monitor(tail *) match the Monitor tool's shell commands in the same way Bash(tail *) matches Bash.

Settings sources and managed settings

A settings file excluded with --setting-sources could still supply some settings, such as auto mode rules and saved permission consents. It no longer does. Separately, Claude's file tools now ask before editing the local copy of an organization's server-managed settings, matching how they already treat a user's own settings files.

Reviewing blocked calls and shell hygiene

Other changes tighten the review flow and the shell. /permissions Recently blocked now refuses to approve a call the user cannot read in full, including one the terminal is too short to show. In Cowork cloud sessions, a hook's allow of an MCP tool call in auto mode now counts as no answer, so the classifier or a permission prompt decides. /ultrareview now checks workspace trust before it runs git. The Bash tool's shell also clears any inherited which alias or function, and no longer passes exported which or unsetenv functions to commands, so which is the system command or the zsh builtin. Blocked shell and MCP calls also no longer read in a collapsed tool group as if they had run.

Takeaway

None of these are headline features, but together they mean sandboxed resumes, Monitor-launched commands and restricted settings sources now behave the way the permission model says they should.